Splunk Search

I need to retrieve results for the last 30 days, but why is my search only returning results for the last 3 days?

gandusarath
Engager

I have this search:

 index=os sourcetype=ps host=rtl*pxiw01* (DataFlowEngine AND *Inbound) earliest=-30d | multikv fields RSZ_KB,VSZ_KB,COMMAND,ARGS | search (COMMAND="DataFlowEngine" AND ARGS=*Inbound) 
| timechart span=1d max(VSZ_KB) as VSZ by host .

I need to retrieve results for last 30 days, but my search head is retrieving results only for the last 3 days. Can someone please advise on how to get results for 30 days?

0 Karma

jkat54
SplunkTrust
SplunkTrust

You used earliest=-3d but do you know of _index_earliest ? and _index_latest ?

Also did you change the timepicker or just specify earliest in your search?

Finally, are the dates right on all your data? Say 27 days of your data was from 2001 due to an incorrect timestamp... Splunk would index these events as if they were 14 years ago, not last 30d. So in this case, you'd be interested in _index_earliest=-3d instead.

0 Karma

Richfez
SplunkTrust
SplunkTrust

Do you have more than 3 days of data in there? If you remove ALL references to time and just run your base search with the time selector set to "all time", what do you get?

This search, that is:

index=os sourcetype=ps host=rtl*pxiw01* (DataFlowEngine AND *Inbound)

Let us know what you find.

0 Karma

MuS
Legend

In addition run this command to see when the index saw the first event form the hosts host=rtl*pxiw01*:

 | metadata type=host index=os | search host=rtl*pxiw01* | convert ctime(firstTime) AS TimeOfFirstEvent | sort - firstTime
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...